carmanagement/apps/api/src/middleware/requireSubscription.ts

import { Request, Response, NextFunction } from 'express'
import { sendUnauthorized, sendPaymentRequired } from './authHelpers'

const BLOCKED_STATUSES = ['SUSPENDED', 'PENDING']

/**
 * Blocks requests for companies with lapsed or unactivated subscriptions.
 * Must be applied after `requireTenant`.
 *
 * Guarantees on success:
 *   req.company.status is not SUSPENDED or PENDING
 */
export function requireSubscription(req: Request, res: Response, next: NextFunction) {
  const company = req.company
  if (!company) return sendUnauthorized(res, 'unauthenticated', 'No company context')

  if (BLOCKED_STATUSES.includes(company.status)) {
    return sendPaymentRequired(
      res,
      `subscription_${company.status.toLowerCase()}`,
      company.status === 'SUSPENDED'
        ? 'Your account has been suspended. Please contact support or renew your subscription.'
        : 'Your account is pending activation. Please complete your subscription setup.',
      { billingUrl: `${process.env.NEXT_PUBLIC_DASHBOARD_URL}/subscription` },
    )
  }

  next()
}